The Linux kernel's IPVS module contained a logic error that prevented checksum validation for ICMPv6 packets coming from clients and for replies from real servers. The check was missing both in the packet receive path and when handling responses, allowing maliciously crafted ICMPv6 messages with bogus pseudo‑header checksums to be accepted as valid. Because the kernel failed to reject these packets, an attacker could potentially trigger incorrect packet processing or cause a local service interruption within the IPVS subsystem, with a risk of compromising traffic integrity or availability.

All Linux kernel installations that include the stock IPVS module and have not incorporated the commit introducing ip_vs_checksum_common_check() are affected. The issue is vendor‑agnostic, meaning distributions that ship the default kernel are impacted regardless of distribution name. The problem persists until the kernel is upgraded to a release that includes the checksum validation fix.

The vulnerability is not listed in CISA KEV and no CVSS score is available. The EPSS score is not published. The likely attack vector is network‑based; an attacker must be able to send ICMPv6 packets to a host running the vulnerable kernel. The missing checksum validation is an input validation flaw (CWE‑20), and exploitation would require the attacker to craft packets with malformed checksums. Because many networks perform checksum off‑load and hardware may already validate traffic, the practical risk of successful exploitation is uncertain, but a local service disruption cannot be ruled out.